boost-skill-cli 1.0.213__tar.gz → 1.0.215__tar.gz

{boost_skill_cli-1.0.213 → boost_skill_cli-1.0.215}/CLAUDE.md

@@ -4,6 +4,36 @@ boost is a "Homebrew for AI coding skills": a Python CLI (`boost_cli`) that find
 installs, and governs the skill/rule/workflow files that AI coding agents run on.
 Package name on PyPI is `boost-skill-cli`; the command is `boost`.
 
+## Common commands
+
+```bash
+make venv                                      # .venv from the hash-pinned requirements/*.txt
+.venv/bin/pytest tests/unit/test_catalog.py -q                    # one test file
+.venv/bin/pytest tests/unit/test_catalog.py::test_scan_dir -q     # one test
+.venv/bin/pytest tests/functional -q -k install                   # functional tests matching "install"
+make lint                                      # the whole static tier — see the recipe, it is 18 commands
+make test                                      # unit + functional with 80% coverage gate
+make check                                     # the full required gate — see table below
+
+# run boost itself against a disposable HOME (never your real ~/.boost):
+export HOME=/tmp/boost-sandbox && mkdir -p $HOME
+python3 tests/make_fixture.py /tmp/fixture-tap
+./boost tap /tmp/fixture-tap
+./boost install brainstorming
+./boost doctor
+```
+
+`make venv` installs from `requirements/*.txt`, which are hash-pinned and are the
+same files CI installs (`scripts/lock_toolchain.py --check` gates them against
+drift) — so a dev venv and a runner resolve to identical bytes. Don't `pip
+install` a lint or test tool by hand; add it to the right requirements file and
+regenerate the lock, or `make lint` passes for you and fails in CI.
+
+The functional/unit `sandbox` fixture (`tests/conftest.py`) also sets
+`BOOST_NO_AI=1` and `BOOST_ASSUME_YES=1` so tests are deterministic and never
+block on a confirm prompt or a real AI call — override explicitly in a test
+that means to exercise the AI or confirmation path.
+
 ## The one gate that matters
 
 Before calling any change done, run the full gate:
@@ -124,9 +154,57 @@ Both boards are data-driven: `docs/roadmap.html` from `board: code` items and
 into the per-track sections; the filter JS and counters are computed). Same rule
 for both — edit items, run `build_roadmap.py`, never touch the HTML by hand.
 
+## Architecture
+
+**CLI dispatch.** `boost_cli/cli.py` holds `COMMANDS`, the single
+source-of-truth list of `(name, group, module, summary)` for all 78 commands.
+Each command is implemented as `def cmd_<name_with_underscores>(argv) -> int`
+inside `boost_cli/commands/<module>.py`, and `_dispatch` imports that module
+lazily on invocation — so `boost --help` stays instant and command modules are
+decoupled from each other. To add a command: add a row to `COMMANDS`, add the
+`cmd_*` function to the named module, and it's live. `docs/commands.html` is
+**generated** from `COMMANDS` by `scripts/build_command_reference.py`, so a new
+row means regenerating it (`make generate`) or the `--check` gate fails.
+
+**commands/ vs core/.** `boost_cli/commands/` is thin CLI glue — argument
+parsing, output formatting, calling into `core/`. `boost_cli/core/` is the
+actual engine (catalog scanning, install/link logic, the lock file, registries,
+search) and is what the mutation gate targets — put behavior there, not in
+the command layer, so it's covered by both the unit suite and mutation
+testing.
+
+**Storage layout**, all resolved at call time from `$HOME` (or `$BOOST_HOME`)
+in `boost_cli/core/paths.py`, which is what makes `HOME=<tempdir>` sandboxing
+work in tests and the dev loop:
+
+```text
+~/.boost/repos/     shallow git clones of tapped registries
+~/.boost/cache/     JSON catalogs built from SKILL.md/rule/workflow frontmatter
+~/.boost/logs/      rotating diagnostic log + crash reports
+~/.boost/state/     pins, tags, policy, profiles, pulse feed, snapshots
+~/.boost/config.json
+~/.agents/skills/                canonical store — single source of truth for installed skills
+~/.agents/skills/.skill-lock.json   v3 lock file
+~/.claude/skills/  ~/.windsurf/skills/  ~/.cursor/skills/   symlinked out from the canonical store
+```
+
+`core/catalog.scan_dir` walks a tap's clone and classifies each file into one
+of the three item kinds (see Non-obvious rules above); `core/store.py` owns
+install, uninstall and sync — copying into the canonical store, symlinking into
+each agent's skills dir, and updating the lock file.
+
+**Search has two engines**, both in `core/`: `rag.py` is the always-on,
+zero-dependency BM25 engine (full-content index, auto-builds on first
+search — this is what the required `eval` gate floors at recall@k ≥ 0.85).
+`dense.py` is optional dense/vector retrieval behind the `[rag]` extra plus
+an embeddings key (`VOYAGE_API_KEY`/`OPENAI_API_KEY`); it's used when both
+are present and falls back to BM25 otherwise. `core/ai.py` wraps the
+opt-in LLM-assisted paths (`search --smart`, `explain`, `distill`, `infer`,
+`absorb`, `evolve`, `simulate`, …), shelling out to the `claude` CLI or
+`ANTHROPIC_API_KEY` when available and degrading to heuristics when not.
+
 ## Layout
 
-- `boost_cli/commands/` — CLI command groups   · `boost_cli/core/` — engine (the mutation-gated code)
 - `boost_cli/data/` — shipped catalog data (generated)   · `scripts/` — build/gate tooling
 - `tests/unit`, `tests/functional`, `tests/smoke.sh` — the three test tiers
-- `docs/` — `overview.html` (visual guide), `DEBUGGING.md`; `roadmap.html` is generated from `docs/roadmap/items/*.md` (see above)
+- `docs/` — `index.html` (visual guide), `commands.html` (every flag, generated), `DEBUGGING.md`; `roadmap.html` is generated from `docs/roadmap/items/*.md` (see above)

{boost_skill_cli-1.0.213/boost_skill_cli.egg-info → boost_skill_cli-1.0.215}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.213
+Version: 1.0.215
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.213 → boost_skill_cli-1.0.215}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.213'
-__version_tuple__ = version_tuple = (1, 0, 213)
+__version__ = version = '1.0.215'
+__version_tuple__ = version_tuple = (1, 0, 215)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.213 → boost_skill_cli-1.0.215/boost_skill_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.213
+Version: 1.0.215
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.213 → boost_skill_cli-1.0.215}/boost_skill_cli.egg-info/SOURCES.txt

@@ -151,6 +151,8 @@ docs/roadmap/items/BOOST-D24.md
 docs/roadmap/items/BOOST-D25.md
 docs/roadmap/items/BOOST-D26.md
 docs/roadmap/items/accessibility-audit-pa11y-ci-axe-core.md
+docs/roadmap/items/ai-bridge-silent-failure-logging.md
+docs/roadmap/items/ambiguous-tap-short-name-resolution.md
 docs/roadmap/items/atomic-corruption-safe-lock-file-writes.md
 docs/roadmap/items/atomic-skill-install-temp-dir-swap.md
 docs/roadmap/items/autonomous-ship-workflow-and-isolated-worktree.md
@@ -161,6 +163,7 @@ docs/roadmap/items/browse-crashes-selecting-a-rule-or-workflow.md
 docs/roadmap/items/build-provenance-slsa-attestations.md
 docs/roadmap/items/cache-the-catalog-entry-set-across-rag-queries.md
 docs/roadmap/items/capability-manifest-and-least-privilege-policy.md
+docs/roadmap/items/ci-job-timeout-minutes.md
 docs/roadmap/items/clean-env-install-smoke-pip-and-pipx.md
 docs/roadmap/items/command-carousel-page.md
 docs/roadmap/items/command-reference-docs-site.md
@@ -168,7 +171,10 @@ docs/roadmap/items/complexity-and-dead-code-radar-xenon-vulture.md
 docs/roadmap/items/consolidate-skill-staleness-drift-logic-into-cor.md
 docs/roadmap/items/coverage-dashboard-codecov-free-for-oss.md
 docs/roadmap/items/coverage-guided-fuzzing-atheris-oss-fuzz.md
+docs/roadmap/items/crash-listing-branch-untested.md
 docs/roadmap/items/crash-recorder-error-paths-core-logs-py.md
+docs/roadmap/items/dense-search-fallback-and-stale-tap-pruning.md
+docs/roadmap/items/dependabot-missing-pip-ecosystem.md
 docs/roadmap/items/dependency-cve-gate-pip-audit.md
 docs/roadmap/items/docsite-chrome-and-content-audit.md
 docs/roadmap/items/docstring-coverage-interrogate.md
@@ -183,17 +189,22 @@ docs/roadmap/items/framework-adapter-langgraph.md
 docs/roadmap/items/framework-adapter-multi-agent.md
 docs/roadmap/items/framework-adapters-boost-adapt.md
 docs/roadmap/items/frontmatter-scalar-over-coercion.md
+docs/roadmap/items/github-community-health-files.md
 docs/roadmap/items/github-pages-deploy-is-broken-every-push.md
 docs/roadmap/items/golden-set-statistical-power.md
 docs/roadmap/items/hash-pinned-reproducible-toolchain-uv-lock.md
 docs/roadmap/items/html-validation-html-validate.md
+docs/roadmap/items/install-from-path-bypasses-policy-and-pin-checks.md
 docs/roadmap/items/install-resolves-skill-dependencies.md
 docs/roadmap/items/install-scope-user-or-project.md
 docs/roadmap/items/installed-skill-trust-audit.md
 docs/roadmap/items/integrity-verification-boost-verify.md
 docs/roadmap/items/invocation-pid-logging-for-crash-correlation.md
+docs/roadmap/items/journal-rotation-race-and-handle-leak.md
 docs/roadmap/items/layering-guard-import-linter.md
+docs/roadmap/items/license-compliance-scanning.md
 docs/roadmap/items/lighthouse-ci-on-the-pages-site.md
+docs/roadmap/items/lint-tap-misscopes-rule-workflow-entries.md
 docs/roadmap/items/list-rules-and-workflows.md
 docs/roadmap/items/localize-the-stored-bm25-snippet.md
 docs/roadmap/items/lockfile-enforcement-and-commit-pinning.md
@@ -212,10 +223,14 @@ docs/roadmap/items/modernization-smells-refurb-pyupgrade.md
 docs/roadmap/items/mutation-hardening-core-frontmatter-py.md
 docs/roadmap/items/mutation-hardening-core-gitutil-py.md
 docs/roadmap/items/mutation-hardening-core-store-py.md
+docs/roadmap/items/mypy-strict-mode-for-commands.md
+docs/roadmap/items/negative-limit-inverts-log-pulse-output.md
+docs/roadmap/items/onboard-overwrites-generated-files-without-confirm.md
 docs/roadmap/items/one-command-every-env-nox.md
 docs/roadmap/items/one-shared-atomic-write-helper.md
 docs/roadmap/items/package-metadata-validation-twine-check-friends.md
 docs/roadmap/items/patch-coverage-gate-diff-cover.md
+docs/roadmap/items/path-traversal-unsanitized-rule-workflow-name.md
 docs/roadmap/items/performance-regression-gate-pytest-benchmark.md
 docs/roadmap/items/pin-the-lint-toolchain.md
 docs/roadmap/items/post-deploy-smoke-headless-load-check.md
@@ -227,10 +242,14 @@ docs/roadmap/items/prompt-injection-scanning-of-skill-markdown.md
 docs/roadmap/items/property-based-tests-hypothesis-on-the-parsers.md
 docs/roadmap/items/prose-and-terminology-linting-vale.md
 docs/roadmap/items/prune-ignored-dirs-during-scan-dir-walk.md
+docs/roadmap/items/publish-gate-ignores-pip-audit-and-metadata.md
+docs/roadmap/items/pytest-tmpdir-cve-blocked-by-py39-floor.md
 docs/roadmap/items/quality-dashboard-sonarcloud-free-for-oss.md
 docs/roadmap/items/ranx-significance-monitor.md
 docs/roadmap/items/reconcile-the-theme-drift.md
 docs/roadmap/items/refresh-the-marketing-surface.md
+docs/roadmap/items/rel-time-tests-race-the-wall-clock.md
+docs/roadmap/items/required-checks-config-drift.md
 docs/roadmap/items/retrieval-quality-eval-harness.md
 docs/roadmap/items/reuse-helpers-kill-minor-dead-work.md
 docs/roadmap/items/robust-tag-argument-parsing.md
@@ -244,25 +263,32 @@ docs/roadmap/items/second-type-checker-pyright.md
 docs/roadmap/items/secret-and-pii-scanning-of-installed-skills.md
 docs/roadmap/items/secret-scanning-gitleaks-push-protection.md
 docs/roadmap/items/security-linting-bandit-via-ruff-s-rules.md
+docs/roadmap/items/self-update-broken-for-pip-pipx-installs.md
+docs/roadmap/items/serve-py-traversal-guards-untested.md
 docs/roadmap/items/shift-left-gate-pre-commit-pre-commit-ci.md
 docs/roadmap/items/single-imperative-rule-extractor.md
 docs/roadmap/items/single-tech-stack-prober.md
 docs/roadmap/items/split-oversized-command-modules.md
 docs/roadmap/items/startup-and-import-time-budget-x-importtime.md
 docs/roadmap/items/stop-re-serializing-entry-meta-on-every-search.md
+docs/roadmap/items/structured-json-log-output-mode.md
 docs/roadmap/items/supply-chain-posture-openssf-scorecard.md
 docs/roadmap/items/surface-every-docs-page-from-the-guide.md
+docs/roadmap/items/sync-deletes-unowned-broken-symlinks.md
 docs/roadmap/items/tap-signing-and-provenance-sigstore-minisign.md
 docs/roadmap/items/theme-asset-linting-stylelint-eslint.md
 docs/roadmap/items/typo-detection-codespell.md
 docs/roadmap/items/typosquat-and-name-confusion-detection.md
 docs/roadmap/items/unify-tilde-two-copies-have-a-boundary-bug.md
+docs/roadmap/items/uninstall-has-no-confirmation-prompt.md
 docs/roadmap/items/untrack-generated-build-noise.md
 docs/roadmap/items/update-diff-before-apply.md
 docs/roadmap/items/update-refreshes-rules-and-workflows.md
+docs/roadmap/items/update-reinstall-widens-agent-scope.md
 docs/roadmap/items/visual-regression-pass-on-the-guide.md
 docs/roadmap/items/widen-the-ruff-rule-surface-b-sim-c4-perf-ruf.md
 docs/roadmap/items/windows-in-the-ci-matrix.md
+docs/roadmap/items/wire-bdd-suite-into-ci.md
 docs/roadmap/items/workflow-install-native-materialization.md
 docs/roadmap/items/workflow-linting-actionlint.md
 docs/roadmap/items/workflow-sast-zizmor.md

boost_skill_cli-1.0.215/docs/roadmap/items/ai-bridge-silent-failure-logging.md

@@ -0,0 +1,20 @@
+---
+id: ai-bridge-silent-failure-logging
+board: code
+section: internals
+status: planned
+category: Observability
+complexity: S
+impact: Med
+wow: 2
+note:
+order: 40
+owner:
+pr:
+title: AI bridge swallows failures with zero diagnostic trail
+---
+<code>core/ai.py</code>'s CLI and API call paths both catch their failure modes (timeout, OS error,
+URL error, bad JSON) and return <code>None</code> — but neither ever calls into the logger, unlike
+the rest of boost. A user whose expired key or flaky network silently degrades every AI-assisted
+command to its heuristic fallback has no trail to diagnose why, even with <code>--debug</code>. Add
+a one-line <code>logger.debug(...)</code> in each except branch.

boost_skill_cli-1.0.215/docs/roadmap/items/ambiguous-tap-short-name-resolution.md

@@ -0,0 +1,22 @@
+---
+id: ambiguous-tap-short-name-resolution
+board: code
+section: internals
+status: planned
+category: Bug
+complexity: S
+impact: High
+wow: 3
+note:
+order: 28
+owner:
+pr:
+title: Ambiguous tap short-name resolution silently picks the wrong tap
+---
+<code>registry.get(name)</code> matches on full name, safe-name, or trailing path segment and returns
+the <em>first</em> hit with no ambiguity check — unlike <code>catalog.resolve_one</code>, which
+explicitly errors on a multi-tap ambiguous match. Three of the five default taps end in
+<code>/skills</code>, so after <code>boost tap --defaults</code>, <code>boost untap skills</code> or
+<code>boost update skills</code> silently resolves to whichever tap sorts first and the others
+become unreachable by short name. Raise on an ambiguous short-name match, mirroring
+<code>resolve_one</code>.

boost_skill_cli-1.0.215/docs/roadmap/items/ci-job-timeout-minutes.md

@@ -0,0 +1,20 @@
+---
+id: ci-job-timeout-minutes
+board: code
+section: pipeline
+status: planned
+category: CI/CD
+complexity: S
+impact: Low
+wow: 1
+note:
+order: 10
+owner:
+pr:
+title: No <code>timeout-minutes</code> on any CI job
+---
+None of the 8 workflow files set <code>timeout-minutes</code>, so a hung step — a stalled tap
+clone, a wedged smoke-test subprocess — runs until GitHub's default job timeout instead of failing
+fast, costliest across the 2 OS &#215; 3 Python <code>tests</code> matrix. Add explicit per-job
+timeouts: short for <code>lint</code>/<code>pip-audit</code>, longer for
+<code>tests</code>/<code>mutation</code>.

boost_skill_cli-1.0.215/docs/roadmap/items/crash-listing-branch-untested.md

@@ -0,0 +1,20 @@
+---
+id: crash-listing-branch-untested
+board: code
+section: internals
+status: planned
+category: Testing · Bug
+complexity: S
+impact: Low
+wow: 1
+note:
+order: 37
+owner:
+pr:
+title: <code>boost log --crashes</code> listing branch has no non-empty test
+---
+<code>_show_crashes</code> has an empty-state branch and a listing branch that reads each
+<code>crash-*.log</code>, extracts its summary line, and swallows <code>OSError</code> on an
+unreadable report — only the empty-state message is exercised by any test. A regression in the glob
+sort, the summary-extraction regex, or the <code>OSError</code> fallback would ship undetected. Add
+a test that seeds one or more crash logs and asserts on the rendered listing.

boost_skill_cli-1.0.215/docs/roadmap/items/dense-search-fallback-and-stale-tap-pruning.md

@@ -0,0 +1,23 @@
+---
+id: dense-search-fallback-and-stale-tap-pruning
+board: code
+section: internals
+status: planned
+category: Bug
+complexity: M
+impact: Med
+wow: 2
+note:
+order: 30
+owner:
+pr:
+title: Dense search's empty result skips the BM25 fallback
+---
+<code>_retrieve_any</code> treats any non-<code>None</code> dense result as final, but
+<code>dense.retrieve()</code> returns <code>[]</code> (not <code>None</code>) whenever every KNN
+neighbor gets filtered by kind mismatch or staleness — silently short-circuiting the documented
+"everything degrades to BM25" contract. Compounding it, <code>dense.build()</code>'s incremental
+path only prunes chunks for taps still present in the current entry set, so a tap removed via
+<code>boost tap remove</code> leaves ghost vectors in <code>rag_vectors.sqlite</code> forever,
+crowding the KNN pool on every future query. Distinguish "dense unavailable" from "dense had zero
+live hits," and prune removed taps on every build, not just changed ones.

boost_skill_cli-1.0.215/docs/roadmap/items/dependabot-missing-pip-ecosystem.md

@@ -0,0 +1,28 @@
+---
+id: dependabot-missing-pip-ecosystem
+board: code
+section: pipeline
+status: planned
+category: Supply chain
+complexity: S
+impact: Low
+wow: 1
+note: extras only — <code>/requirements</code> is covered
+order: 11
+owner:
+pr:
+title: Dependabot's <code>pip</code> entry misses <code>pyproject.toml</code>'s extras
+---
+<code>.github/dependabot.yml</code> declares <code>pip</code> for
+<code>directory: /requirements</code>, so the hash-pinned dev/CI toolchain does get weekly
+bump PRs. What it does <b>not</b> cover is <code>pyproject.toml</code> at the repo root:
+Dependabot only scans manifests under the declared <code>directory</code>, so the optional
+extras — <code>[rag]</code> (sqlite-vec), <code>[eval]</code> (ranx, ragas and the pinned
+langchain 0.3 stack), <code>[bdd]</code> (behave), <code>[perf]</code> (pytest-benchmark) —
+never get proactive version-bump PRs, only reactive <code>pip-audit</code> CVE flags.
+Low impact by design: <code>[project].dependencies</code> is empty, so none of this reaches
+anyone who installs <code>boost-skill-cli</code> — it is contributor-facing only. The fix is
+a second <code>pip</code> entry with <code>directory: /</code>. Weigh it against the noise:
+the <code>[eval]</code> stack is <b>deliberately</b> held at langchain 0.3 because ragas
+0.2.x breaks against langchain &ge;1.0, so that one will raise PRs that must be closed
+unmerged until ragas catches up.

boost_skill_cli-1.0.215/docs/roadmap/items/github-community-health-files.md

@@ -0,0 +1,21 @@
+---
+id: github-community-health-files
+board: code
+section: dx
+status: planned
+category: Developer Experience
+complexity: S
+impact: Med
+wow: 2
+note:
+order: 11
+owner:
+pr:
+title: No issue/PR templates or a code of conduct
+---
+The repo has <code>SECURITY.md</code>, <code>CONTRIBUTING.md</code>, and
+<code>dependabot.yml</code>, but no <code>.github/ISSUE_TEMPLATE/</code>, no
+<code>.github/PULL_REQUEST_TEMPLATE.md</code>, and no <code>CODE_OF_CONDUCT.md</code>. For a project
+that explicitly expects parallel external contributors (per the worktree-coordination rules in
+<code>CONTRIBUTING.md</code>), a bug-report template built around <code>boost doctor</code>/crash-log
+output and a PR checklist would cut triage friction more cheaply than most engine work.

boost_skill_cli-1.0.215/docs/roadmap/items/install-from-path-bypasses-policy-and-pin-checks.md

@@ -0,0 +1,23 @@
+---
+id: install-from-path-bypasses-policy-and-pin-checks
+board: code
+section: trust
+status: planned
+category: Security · Bug
+complexity: S
+impact: High
+wow: 3
+note: code-scan finding
+order: 9
+owner:
+pr:
+title: <code>install_from_path</code> bypasses pin &amp; policy checks
+---
+<code>boost import</code>, <code>boost migrate --from-skills-cli</code>, <code>boost rename</code>,
+and the local-install paths behind the AI <code>distill</code>/<code>evolve</code> commands all
+route through <code>store.install_from_path()</code>, which never calls
+<code>policy.check_install()</code> and never checks <code>existing.get("pinned")</code> the way
+<code>store.install()</code> does. Any of those commands can silently overwrite a pinned skill, or
+one that <code>blocked_skills</code>/<code>allowed_taps</code>/<code>max_skills</code>/<code>pin_only</code>
+policy would otherwise refuse. Route <code>install_from_path</code> through the same
+pinned/existing/policy gates as <code>install()</code>.

boost_skill_cli-1.0.215/docs/roadmap/items/journal-rotation-race-and-handle-leak.md

@@ -0,0 +1,22 @@
+---
+id: journal-rotation-race-and-handle-leak
+board: code
+section: internals
+status: planned
+category: Concurrency · Bug
+complexity: M
+impact: Med
+wow: 2
+note:
+order: 31
+owner:
+pr:
+title: Journal rotation has a lost-update race between concurrent processes
+---
+<code>_maybe_rotate</code> reads the whole pulse file and atomically replaces it with a truncated
+snapshot — but two concurrent boost processes (explicitly expected per this repo's parallel-loop
+model) can both read, then both write their own snapshot, and whichever writes last silently
+discards any event the other appended in between. <code>rotation_healthy()</code> also opens the
+file with a bare <code>p.open()</code> and never closes it, relying on GC instead of a
+<code>with</code> block like every other open in the module. Rotate under a lock (or an
+append-only rename scheme), and close the handle explicitly.

boost_skill_cli-1.0.215/docs/roadmap/items/license-compliance-scanning.md

@@ -0,0 +1,21 @@
+---
+id: license-compliance-scanning
+board: code
+section: pipeline
+status: planned
+category: Supply chain
+complexity: S
+impact: Med
+wow: 2
+note:
+order: 12
+owner:
+pr:
+title: License-compliance scanning of the dependency closure
+---
+Nothing in CI checks SPDX license compatibility of resolved dependencies — <code>pip-audit</code>
+gates known CVEs, not license terms, and the <code>[eval]</code>/<code>[rag]</code> extras pull in a
+nontrivial transitive closure (the langchain stack, ragas, sqlite-vec) whose licenses are never
+verified against boost's own. Add a <code>pip-licenses --fail-on</code> (or <code>reuse lint</code>)
+step to <code>package-metadata.yml</code> to catch an incompatible transitive dependency before an
+extra ships it.

boost_skill_cli-1.0.215/docs/roadmap/items/lint-tap-misscopes-rule-workflow-entries.md

@@ -0,0 +1,21 @@
+---
+id: lint-tap-misscopes-rule-workflow-entries
+board: code
+section: internals
+status: planned
+category: Bug
+complexity: S
+impact: Med
+wow: 2
+note:
+order: 34
+owner:
+pr:
+title: <code>lint --tap</code> mis-scores rule/workflow entries as broken
+---
+<code>boost lint --tap</code> builds its target list without filtering by kind, so rule/workflow
+catalog entries (which have no <code>SKILL.md</code>) always report "missing SKILL.md," and
+repo-root items get scored against the entire tap directory instead of their actual file. Running
+it against any tap that mixes rules/workflows with skills makes every rule/workflow entry show a
+bogus error and a garbage score. Skip or special-case non-skill kinds, mirroring the kind-branching
+already used elsewhere in <code>pkg.py</code>.

boost_skill_cli-1.0.215/docs/roadmap/items/mypy-strict-mode-for-commands.md

@@ -0,0 +1,23 @@
+---
+id: mypy-strict-mode-for-commands
+board: code
+section: health
+status: planned
+category: Testing · Type
+complexity: M
+impact: High
+wow: 3
+note:
+order: 11
+owner:
+pr:
+title: mypy's default mode skips untyped command bodies
+---
+<code>[tool.mypy]</code> in <code>pyproject.toml</code> sets only <code>python_version</code>/
+<code>files</code>, leaving mypy in its default permissive mode — a function with any untyped
+parameter has its <em>body</em> skipped entirely. All 76 <code>cmd_*</code> functions across
+<code>boost_cli/commands/*.py</code> take a bare <code>argv</code>, and a third have no return-type
+annotation, so the required "zero mypy errors" lint gate isn't actually checking most of the CLI's
+dispatch logic. Scoping <code>disallow_untyped_defs</code> (or at least
+<code>check_untyped_defs</code>) to <code>boost_cli.commands</code> will surface a real backlog —
+exactly what the gate is supposed to catch.

boost_skill_cli-1.0.215/docs/roadmap/items/negative-limit-inverts-log-pulse-output.md

@@ -0,0 +1,21 @@
+---
+id: negative-limit-inverts-log-pulse-output
+board: code
+section: internals
+status: planned
+category: CLI ergonomics
+complexity: S
+impact: Low
+wow: 1
+note:
+order: 36
+owner:
+pr:
+title: Negative <code>-n</code> silently inverts <code>log</code>/<code>pulse</code> output
+---
+<code>boost log</code>/<code>boost pulse</code> accept <code>-n</code>/<code>--limit</code> as a bare
+<code>type=int</code> with no positivity check, and the slicing does
+<code>out[:n] if n else out</code> — a negative <code>n</code> becomes a Python negative slice, so
+<code>-n -1</code> silently returns everything except the most recent event instead of erroring.
+<code>discovery.py</code>'s <code>--limit</code> flags already share a <code>_positive_int</code>
+validator that rejects values below 1; reuse it here.

boost_skill_cli-1.0.215/docs/roadmap/items/onboard-overwrites-generated-files-without-confirm.md

@@ -0,0 +1,21 @@
+---
+id: onboard-overwrites-generated-files-without-confirm
+board: code
+section: internals
+status: planned
+category: UX · Bug
+complexity: S
+impact: Med
+wow: 2
+note:
+order: 35
+owner:
+pr:
+title: <code>boost onboard</code> silently overwrites existing generated files
+---
+<code>boost onboard</code> writes <code>.boost/telemetry.json</code>, a GitHub Actions workflow, and
+<code>.skill-lock.json</code> via a bare <code>write_text()</code> with no existence check,
+confirmation, or diff — unlike the sibling "write a generated file" helper elsewhere in the
+codebase, which always confirms before overwriting. Re-running it on a repo with its own tracked
+lock file silently clobbers it and still reports "created," even though it overwrote. Check
+<code>dest.exists()</code> and route through <code>out.confirm()</code> first.

boost_skill_cli-1.0.215/docs/roadmap/items/path-traversal-unsanitized-rule-workflow-name.md

@@ -0,0 +1,24 @@
+---
+id: path-traversal-unsanitized-rule-workflow-name
+board: code
+section: trust
+status: planned
+category: Security · Bug
+complexity: M
+impact: High
+wow: 3
+note: live-reproduced
+order: 10
+owner:
+pr:
+title: Path traversal via unsanitized rule/workflow name
+---
+<code>catalog._make_entry</code> only slugifies a catalog name when it contains a space, so a tap's
+rule/workflow frontmatter carrying <code>name: ../../../../.ssh/authorized_keys</code> sails straight
+through into <code>rule_target</code>/<code>workflow_target</code>, which build the destination as
+<code>root / "rules" / (name + ext)</code> with zero traversal guard — unlike
+<code>skill_store_dir()</code>'s <code>[A-Za-z0-9._-]+</code> regex. A malicious tap can write an
+arbitrary file outside <code>.cursor/rules/</code> or <code>.claude/</code>, and it is worse under
+<code>--scope project</code> since <code>base</code> is the victim's own repo. Apply the same
+name-validation regex used by <code>skill_store_dir()</code> before any rule/workflow install path
+is built.

boost_skill_cli-1.0.215/docs/roadmap/items/publish-gate-ignores-pip-audit-and-metadata.md

@@ -0,0 +1,21 @@
+---
+id: publish-gate-ignores-pip-audit-and-metadata
+board: code
+section: pipeline
+status: planned
+category: CI/CD
+complexity: S
+impact: High
+wow: 3
+note: gates PyPI
+order: 9
+owner:
+pr:
+title: <code>publish.yml</code> ignores the <code>pip-audit</code> / metadata gates
+---
+<code>publish.yml</code> triggers on <code>workflow_run: [ci]</code> and gates only on
+<code>github.event.workflow_run.conclusion == 'success'</code> — it never checks the
+independently-triggered <code>pip-audit.yml</code> or <code>package-metadata.yml</code> workflows
+that run on the same push. A merge that fails the live-CVE gate or the twine/metadata check still
+auto-publishes to PyPI as long as <code>ci</code> itself is green. Fold both as jobs inside
+<code>ci.yml</code>, or have the release job poll their run status via the API before publishing.